Valgrind 无效的读/写列表答案

【问题标题】：Valgrind Invalid read/write listValgrind 无效的读/写列表
【发布时间】：2012-02-10 18:29:54
【问题描述】：

即使经过大量研究，我仍然不明白为什么我会从 valgrind 收到此错误.. 有类秒杀（实现了伪双链表）

class spike
{
  int s_cell;
  int s_begin;
  int s_number;
  int s_type;
  spike *s_previous;
  spike *s_next;

  spike *s_origin; // pointer for original spike or itself
                   // (in the very first spike_data )

  spike *s_derive; // pointer for the spike in the derived class
                   // (note, that sometimes there are 2 or more high
                   // order spike_data in parallel; the pointer is only to one)
public:
  spike(int c, int b, int n, int typ=c_normal)
  {
    s_cell = c;
    s_begin = b;
    s_number = n;
    s_previous = NULL;
    s_next = NULL;
    s_derive = NULL;
    s_origin = this;
    s_type = typ;
  }

  ~spike()
  {
    kill();
  }

还有spike_data类。

class spike_data
{
protected:
  int sd_mode;
  int sd_size;
  int sd_number;      // the whole number of spikes 
  int sd_file;        // the number of files for analysis
  int *sd_file_name;  // the names of files used in the analysis
  int sd_cells;       // the whole number of different cells

  spike **sd_array;   // array of all spikes
  spike *sd_first[c_maxcells]; // array of the first entries of spikes
  spike **sd_file_st; // spikes in array for indication of beginning of the new files

// And here is the part that's getting the error
// (it is happening when i try to release)
void spike::kill()
{
  // delete a cell from all references and t becomes "dead"
  // actual release of memory is done in renumerate
  try
  {
    if (s_previous != NULL)
      s_previous->s_next = s_next;
    if (s_next != NULL)
      s_next->s_previous = s_previous;
    if (s_origin && s_origin != this)
    {
      int tmp = 1;
    while(tmp == 1) {
        if (s_origin != NULL) {
            if (s_origin->s_derive != NULL) { // LINE 674
                if ( s_origin->s_derive != this ) { // LINE 675
                        s_origin=s_origin->s_derive;
                    }
                    else tmp = 0;
                }
            else tmp = 0;                       
                     }
             else tmp = 0;
    }

        s_origin->s_derive=NULL; // LINE 685
    }
  }
  catch (...)
  {
  }
  s_next = NULL;
  s_previous = NULL;
  s_origin = NULL;
}


spike_data::~spike_data()
{

if(sd_array!=NULL)
{
    for(int i=0;i<sd_number;i++)
        delete sd_array[i]; // LINE 697

    delete[] sd_array;
    sd_array=NULL;
}
if(sd_file_st!=NULL)
{
    delete[] sd_file_st;
    sd_file_st=NULL;
}
if(sd_file_name!=NULL)
{
    delete[] sd_file_name;
    sd_file_name=NULL;
}
}

对不起，如果代码不消化，它不是我的，但它仍然可以......

Invalid read of size 4
==2079==    at 0x806B0DF: spike::kill() (spikes.cpp:674)
==2079==    by 0x8067D26: spike::~spike() (spike.h:288)
==2079==    by 0x806B174: spike_data::~spike_data() (spikes.cpp:689)
==2079==    by 0x805CB1F: spike_anal::~spike_anal() (spikea.cpp:151)
==2079==    by 0x8061C1E: statistical_analysis(spike_group*, spike_data*) (spikeg.cpp:264)
==2079==    by 0x804B37E: calculate_something(int, int) (all.cpp:422)
==2079==    by 0x8059805: real_main(int, char const*) (simple.cpp:742)
==2079==    by 0x804DC20: main (hello.cpp:66)
==2079==  Address 0x5d8f534 is 28 bytes inside a block of size 32 free'd
==2079==    at 0x4023881: operator delete(void*) (vg_replace_malloc.c:387)
==2079==    by 0x806B17C: spike_data::~spike_data() (spikes.cpp:697)
==2079==    by 0x805CB1F: spike_anal::~spike_anal() (spikea.cpp:151)
==2079==    by 0x8061C06: statistical_analysis(spike_group*, spike_data*) (spikeg.cpp:264)
==2079==    by 0x804B37E: calculate_something(int, int) (all.cpp:422)
==2079==    by 0x8059805: real_main(int, char const*) (simple.cpp:742)
==2079==    by 0x804DC20: main (hello.cpp:66)
==2079== 
==2079== Invalid read of size 4
==2079==    at 0x806B0EC: spike::kill() (spikes.cpp:675)
==2079==    by 0x8067D26: spike::~spike() (spike.h:288)
==2079==    by 0x806B174: spike_data::~spike_data() (spikes.cpp:689)
==2079==    by 0x805CB1F: spike_anal::~spike_anal() (spikea.cpp:151)
==2079==    by 0x8061C1E: statistical_analysis(spike_group*, spike_data*) (spikeg.cpp:264)
==2079==    by 0x804B37E: calculate_something(int, int) (all.cpp:422)
==2079==    by 0x8059805: real_main(int, char const*) (simple.cpp:742)
==2079==    by 0x804DC20: main (hello.cpp:66)
==2079==  Address 0x5d8f534 is 28 bytes inside a block of size 32 free'd
==2079==    at 0x4023881: operator delete(void*) (vg_replace_malloc.c:387)
==2079==    by 0x806B17C: spike_data::~spike_data() (spikes.cpp:697)
==2079==    by 0x805CB1F: spike_anal::~spike_anal() (spikea.cpp:151)
==2079==    by 0x8061C06: statistical_analysis(spike_group*, spike_data*) (spikeg.cpp:264)
==2079==    by 0x804B37E: calculate_something(int, int) (all.cpp:422)
==2079==    by 0x8059805: real_main(int, char const*) (simple.cpp:742)
==2079==    by 0x804DC20: main (hello.cpp:66)
==2079== 
==2079== Invalid write of size 4
==2079==    at 0x806B10A: spike::kill() (spikes.cpp:685)
==2079==    by 0x8067D26: spike::~spike() (spike.h:288)
==2079==    by 0x806B174: spike_data::~spike_data() (spikes.cpp:689)
==2079==    by 0x805CB1F: spike_anal::~spike_anal() (spikea.cpp:151)
==2079==    by 0x8061C1E: statistical_analysis(spike_group*, spike_data*) (spikeg.cpp:264)
==2079==    by 0x804B37E: calculate_something(int, int) (all.cpp:422)
==2079==    by 0x8059805: real_main(int, char const*) (simple.cpp:742)
==2079==    by 0x804DC20: main (hello.cpp:66)
==2079==  Address 0x5d8f534 is 28 bytes inside a block of size 32 free'd
==2079==    at 0x4023881: operator delete(void*) (vg_replace_malloc.c:387)
==2079==    by 0x806B17C: spike_data::~spike_data() (spikes.cpp:697)
==2079==    by 0x805CB1F: spike_anal::~spike_anal() (spikea.cpp:151)
==2079==    by 0x8061C06: statistical_analysis(spike_group*, spike_data*) (spikeg.cpp:264)
==2079==    by 0x804B37E: calculate_something(int, int) (all.cpp:422)
==2079==    by 0x8059805: real_main(int, char const*) (simple.cpp:742)
==2079==    by 0x804DC20: main (hello.cpp:66)

原来如此。当我想杀死spike_data时，每次我调用delete sd_array[i]，它都会调用spike => kill()的析构函数问题是最后的代码错误。它在执行过程中使用了很多次，并且在某些时候，当所有计算完成并需要释放内存时，它就不起作用了。我认为当我输入 s_origin->s_derive=NULL 时有问题。却抓不住……

如果您需要更多代码，请询问 :)

非常感谢那些有勇气进入这段代码的人！！

周末愉快

尼哥

【问题讨论】：

OMG 请在发布之前处理您的代码外观！我正在编辑它
不明白为什么代码样式不适用于类的第一行。对不起。还是你在谈论风格？是的，我同意这真的是一种折磨。我会尝试将这段代码更改为更好看的代码。它来自俄罗斯^^
我改了。它更好。由于没有换行而失败^^
你能把每个语句放在单独的行并重新生成 valgrind 输出吗？另外，你能把长的a && b && c ... 条件改写成ifs (if(a) {\n if(b) {\n if(c) {\n}\n } \n}) 的树，每个都换行吗？
您确定 s_origin 仍然有效吗？如果元素 B 的 s_origin 指向该数组中的另一个前一个对象 A，则在删除 B 时 A 已经被删除，并且指针 B->s_origin 在该点将无效。

标签： c++ memory-management valgrind

【解决方案1】：

很有可能在您没有注意到的情况下调用了 spike 的默认复制构造函数。如果是这种情况，第一个析构函数可能会正确运行，但第二个调用会导致 valgrind 转储您发布的消息。

为了看看是不是这样，如果你使用的是C++11，添加：

public:
  spike( const spike& rhs ) = delete;

你的代码应该编译失败，这表明你需要编写自己的复制构造函数。

如果您不使用 C++11，则可以编写自己的复制构造函数并在其中放置一个断点，以查看它是否在调试时停止。

【讨论】：

我已经创建了一个像这样的复制构造函数 spin::spike( const peak& rhs ){ } 并按照你所说的那样放置一个中断，但是程序永远不会停止，所以它不会调用任何复制构造函数... :/ thx 无论如何！！
原程序员使用了大量的 memcpy cmd（而不是复制构造函数：旧代码）。例如：dop = 新尖峰*[sd_size]； memcpy(dop,sd_array,sizeof(spike*)*sd_number);我会努力的，可能就是这样。
在spikes.cpp:689 和spikes.cpp:697 上放置断点 - 当你到达断点时打印出被释放的内存位置。然后将断点更改为条件断点以在变量再次为该地址时停止。当它再次达到该点时，向上调用堆栈，您将看到问题。您在这里有一个确定性内存错误 - 应该不难调试（除非您的调用堆栈中有令人讨厌的意大利面条代码）。你将不得不用你的眼睛和大脑来捕捉这个。
你建议我做什么......这不是和 valgrind 做的一样，并在它的输出中显示给我...... ??